laaangsom opdatering

For 120'ende gang -> Generelt - skal vi gætte:
Win98, W2000, XP, Vista, ... , ... ?

Nå ja, dumt.
xp-home og explorer 7(mener jeg). jeg har en 10mb forbindelse, som dog siger mellem ca. 8 og 9.5 når jeg måler den.
Har også prøvet at høre uden om den trådløse router(hvor denne pc er forbundet med kabel), det gør ingen forskel.

... du kunne rulle denne 'pakke' ->

Hent og instalér CCleaner http://www.ccleaner.com/ + http://www.spywarefri.dk/manualer/ccleaner-manual.htm
Under installationen får du tilbudt [Yahoo Toolbar]. Du kan sige ja eller *NEJ* til den.
Lad programmet foretage en oprydning...

--------

Hent Malwarebytes Anti-Malware herfra:
http://www.besttechie.net/tools/mbam-setup.exe
Eller herfra ->
http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html

Installer programmet - når det er gjort skal du lade programmet opdatere sig. Herefter åbner et vindue, hvor du skal flytte prikken til "Kør et fuldstændigt systemscan" - klik på Skan Knappen - lad programmet arbejde. Når det er færdig (det tager lidt tid afhængig af hvor meget du har på computeren).
Derefter - Tryk på "Vis resultater" knappen efter scanningen - og herefter tryk på "Fjern det valgte" - nu åbnes log'en og du skal gemme den et sted, hvor du kan finde den igen.
Kopier indholdet herind sammen med en frisk log fra HiJackThis...

...og her er omtalte HiJackThis ->
http://www.spywareinfo.dk/index.htm#/manualer/hijackthis.htm

Bemærk at HiJackThis.exe programmet skal gemmes i en dertil oprettet mappe og IKKE køres direkte fra nettet...

PS: Brug denne version af HJT -> http://www.trendsecure.com/portal/en-US/_download/HiJackThis.exe

Det vil jeg prøve.

Opklarende.

Er log's fra malwarebytes og hjt nogle jeg gemmer for sikkerheds skyld?

Den "friske" log fra HJT?, altså jeg kører HJT efter MWB og gemmer log når jeg bli'r spurgt( som med Ccleaner)?

Det er breakink ground for mig, jeg vil nødig skade mere end jeg gavner.
Tak for hjælpen

(Bare kom med optalte logs ... dog IKKE fra CCleaner...)

Nu er mbam og hjt kørt. fik selvfølgelig dummet mig, da jeg siger gem til mbam logfil siger den er gemt i mappen "logs", - den kan jeg bare ikke finde nogen steder på pcén selv med søgning i skjulte mapper/filer - hvad gør man så

HJT - log:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:21:07, on 20-04-2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Programmer\Webroot\Spy Sweeper\WRConsumerService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Webroot\Spy Sweeper\SpySweeper.exe
C:\Programmer\Java\jre1.6.0_02\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\Programmer\Fælles filer\InterVideo\SchSvr\SchSvr.exe
C:\Programmer\InterVideo\Common\Bin\WinRemote.exe
C:\Programmer\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\keyhook.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\WINDOWS\system32\rundll32.exe
C:\HP\KBD\KBD.EXE
C:\Programmer\QuickTime\qttask.exe
C:\Programmer\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Programmer\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\HP\Digital Imaging\bin\hpqtra08.exe
C:\Programmer\Yahoo!\Widgets\YahooWidgets.exe
C:\Programmer\iPod\bin\iPodService.exe
C:\Programmer\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Documents and Settings\HP_Ejer\Skrivebord\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/webhp?rls=ig
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Programmer\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Programmer\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Programmer\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmer\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Hjælp til tilmelding til Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmer\Fælles filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programmer\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmer\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Programmer\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O3 - Toolbar: HP-visning - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Programmer\HP\Digital Imaging\bin\HPDTLK02.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programmer\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmer\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [hpsysdrv] "c:\windows\system\hpsysdrv.exe"
O4 - HKLM\..\Run: [Home Theater SchSvr] "C:\Programmer\Fælles filer\InterVideo\SchSvr\SchSvr.exe"
O4 - HKLM\..\Run: [WINREMOTE] "C:\Programmer\InterVideo\Common\Bin\WinRemote.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmer\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Recguard] "C:\WINDOWS\SMINST\RECGUARD.EXE"
O4 - HKLM\..\Run: [NvCplDaemon] "C:\WINDOWS\system32\RUNDLL32.EXE" C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "C:\WINDOWS\system32\nwiz.exe" /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [SiS Windows KeyHook] "C:\WINDOWS\System32\keyhook.exe"
O4 - HKLM\..\Run: [AlcxMonitor] "C:\WINDOWS\ALCXMNTR.EXE"
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [SetDefaultPrinter] "c:\hp\bin\cloaker.exe" c:\windows\system32\cmd.exe /c c:\hp\bin\defaultprinter\SetDefaultPrinter.cmd
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Programmer\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [KBD] "C:\HP\KBD\KBD.EXE"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVP] "C:\Programmer\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKLM\..\Run: [SpySweeper] "C:\Programmer\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKCU\..\Run: [swg] "C:\Programmer\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [updateMgr] "C:\Programmer\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [ctfmon.exe] "C:\WINDOWS\system32\ctfmon.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETVÆRKSTJENESTE')
O4 - Startup: Yahoo! Widgets.lnk = C:\Programmer\Yahoo!\Widgets\YahooWidgets.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: Adobe Reader Hurtigstart.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: CaSup.lnk = C:\hp\region\CustAtStartUp.wsf
O4 - Global Startup: Digimax Viewer 2.1.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programmer\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: MsnFixer.lnk = ?
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Tilføj til bannerreklameblokeringen - C:\Programmer\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Statistik over beskyttelse af webtrafik - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Programmer\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: HP Klipsamling - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Programmer\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: HP Smart markering - {700259D7-1666-479a-93B1-3250410481E8} - C:\Programmer\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\bglsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\bglsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\bglsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\bglsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\bglsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\bglsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\bglsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\bglsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\bglsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\bglsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\bglsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\bglsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\bglsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\bglsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\bglsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\bglsp.dll
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://downol.dr.dk/download/netradio/Rawflow.cab
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813
O16 - DPF: {07E8D22D-C723-485C-BE6F-003241549305} (Ceplan Object) - http://extcom.esoft.dk/extern/3d/eplan.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Programmer\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/FacebookPhotoUploader3.cab
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.com/players/play365.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Programmer\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Programmer\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Programmer\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmer\Fælles filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Programmer\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. (www.webroot.com) - C:\Programmer\Webroot\Spy Sweeper\SpySweeper.exe
O23 - Service: Webroot Client Service (WRConsumerService) - Webroot Software, Inc.  - C:\Programmer\Webroot\Spy Sweeper\WRConsumerService.exe

--
End of file - 11656 bytes

har nu fundet en masse log-filer, men hvad hedder mon den fra mbam

Kør [malwarebytes] - Fanebladet [Logs] ... der er de...

her er den:

Malwarebytes' Anti-Malware 1.36
Database version: 2013
Windows 5.1.2600 Service Pack 3

20-04-2009 20:02:11
mbam-log-2009-04-20 (20-02-11).txt

Skan type: Fuldstændig skanning (C:\|D:\|)
Objekter skannet: 210895
Tid tilbagelagt: 55 minute(s), 41 second(s)

Inficerede Hukommelses Processer: 0
Inficerede Hukommelses Moduler: 0
Inficerede Registeringsdatabase Nøgler: 0
Inficerede Registeringsdatabase Værdier: 0
Inficerede Registeringsdatabase Filer: 0
Inficerede Mapper: 1
Inficerede Filer: 7

Inficerede Hukommelses Processer:
(Ingen mistænkelige filer fundet)

Inficerede Hukommelses Moduler:
(Ingen mistænkelige filer fundet)

Inficerede Registeringsdatabase Nøgler:
(Ingen mistænkelige filer fundet)

Inficerede Registeringsdatabase Værdier:
(Ingen mistænkelige filer fundet)

Inficerede Registeringsdatabase Filer:
(Ingen mistænkelige filer fundet)

Inficerede Mapper:
C:\Documents and Settings\Prootools\Application Data\ultra (Rogue.Multiple) -> Quarantined and deleted successfully.

Inficerede Filer:
C:\audio software\sonic foundry\Sony Sound Forge 7.0 KeyGen.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Prootools\Application Data\ultra\uninstall.bat (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\WINDOWS\inf\ultra.inf (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\inf\ultra.PNF (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\dlh9jkd1q8.exe (Heuristics.Malware) -> Quarantined and deleted successfully.
C:\Documents and Settings\Prootools\Skrivebord\Free PC Wallpapers.lnk (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\Prootools\Skrivebord\Repair Your Registry.lnk (Rogue.Link) -> Quarantined and deleted successfully.

... Joooo - der var jo noget...

Ska' vi lige ta' denne pakken med ->

-- Hent Combofix fra et af disse links, og gem den på dit skrivebord:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://download.bleepingcomputer.com/sUBs/Beta/ComboFix.exe

-- Kør så combofix.exe, som du hentede tidligere, og følg anvisningerne.
Du bør ikke klikke på vinduet imens værktøjet kører, idet det kan få din computer til at fryse.
Når combofix er færdig, og efter det har genstartet, skulle der gerne åbnes en logfil: combofix.txt
Indholdet af denne fil må du gerne lægge herind.

-------

PS: Der er lidt efterfølgende oprydning - det kommer vi tilbage til...

så for..

kører combofix

lukker kaspersky ned

combofix genstarter, beder om at kaspersky lukkes ned igen

det gør jeg

kombofix forbereder log fil

og så kommer der et vindue.

"exception processing messege c000013 parameters75b4bf7c 4"

og siger "windows - ingen diskette"

Forsøg igen    eller    fortsæt

Hva så?  fortsæt??

Nu er det som følger:

der står et blåt combofixvindue:

Vent venligst
Adgang nægtet
c:\windows\system32\drivers\combo-fix.sys blev ikke fundet
.
vinduet kan ikke lukkes, bortset fra det ser det ud til at alt er normalt. har ikke sluttet den til nettet endnu

log filen:

ComboFix 09-04-21.01 - HP_Ejer 20-04-2009 21:16.1 - NTFSx86
Microsoft Windows XP Home Edition  5.1.2600.3.1252.45.1030.18.1023.581 [GMT 2:00]
Kører fra: c:\documents and settings\HP_Ejer\Skrivebord\ComboFix.exe
AV: Kaspersky Internet Security *On-access scanning disabled* (Updated)
FW: Kaspersky Internet Security *disabled*
* Dannede nyt systemgendannelsespunkt
.

(((((((((((((((((((((((((((((((((((((((  Andet, der er slettet  )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\HP_Ejer\Application Data\install.dat
c:\documents and settings\HP_Ejer\Application Data\Microsoft\SystemCertificates\Request
c:\documents and settings\HP_Ejer\err.log
c:\documents and settings\Prootools\Application Data\HbTools
c:\documents and settings\Prootools\Application Data\HbTools\HbTools.log
c:\documents and settings\Prootools\Application Data\HbTools\HbTools_1174492327.log
c:\documents and settings\Prootools\Application Data\HbTools_Icons
c:\documents and settings\Prootools\Application Data\HbTools_Icons\games2.ico
c:\documents and settings\Prootools\Application Data\HbTools_Icons\Registryrepair.ico
c:\documents and settings\Prootools\Application Data\HbTools_Icons\wallpapere1.ico
c:\documents and settings\Prootools\Application Data\Install.dat
c:\documents and settings\Prootools\err.log
c:\progra~1\FLLESF~1\{1C507~1
c:\progra~1\FLLESF~1\{3C507~1
c:\progra~1\FLLESF~1\{3C507~1\Bar888.dll
c:\progra~1\FLLESF~1\{3C507~1\UnInstall.exe
c:\programmer\INSTALL.LOG
c:\windows\system32\AutoRun.inf
c:\windows\system32\dfbde1_g.dll
D:\Autorun.inf

.
(((((((((((((((((((((((((((((  Filer skabt fra 2009-03-20 til 2009-04-20  )))))))))))))))))))))))))))))))))))
.

2009-05-03 16:22 . 2009-05-03 16:22    --------    d-----w    c:\programmer\plasq
2009-05-03 13:55 . 2009-05-03 13:55    79184    ----a-w    c:\windows\system32\BGLsp.dll
2009-05-03 12:58 . 2009-05-03 12:58    63049904    ----a-w    C:\avg_free_stf_en_85_285a1462.exe
2009-04-20 16:03 . 2009-04-20 16:03    --------    d-----w    c:\documents and settings\HP_Ejer\Application Data\Malwarebytes
2009-04-20 16:03 . 2009-04-06 13:32    15504    ----a-w    c:\windows\system32\drivers\mbam.sys
2009-04-20 16:03 . 2009-04-06 13:32    38496    ----a-w    c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-20 16:03 . 2009-04-20 16:03    --------    d-----w    c:\programmer\Malwarebytes' Anti-Malware
2009-04-20 16:03 . 2009-04-20 16:03    --------    d-----w    c:\documents and settings\All Users\Application Data\Malwarebytes
2009-04-19 10:22 . 2009-04-19 10:37    89601    ----a-w    c:\windows\system32\drivers\klick.dat
2009-04-19 10:22 . 2009-04-19 10:37    101287    ----a-w    c:\windows\system32\drivers\klin.dat
2009-04-19 10:21 . 2009-04-20 19:22    --------    d-----w    c:\documents and settings\All Users\Application Data\Kaspersky Lab
2009-04-19 10:21 . 2009-04-20 19:22    573472    --sha-w    c:\windows\system32\drivers\fidbox2.dat
2009-04-19 10:21 . 2009-04-20 19:22    3040    --sha-w    c:\windows\system32\drivers\fidbox2.idx
2009-04-19 10:21 . 2009-04-20 19:20    4150304    --sha-w    c:\windows\system32\drivers\fidbox.dat
2009-04-19 10:21 . 2009-04-20 19:20    33504    --sha-w    c:\windows\system32\drivers\fidbox.idx
2009-04-19 10:21 . 2009-04-19 10:21    --------    d-----w    c:\programmer\Kaspersky Lab
2009-04-19 09:48 . 2009-04-19 09:48    23    ----a-w    c:\windows\system32\afddbeab_g.ocx
2009-04-19 09:47 . 2009-04-19 09:48    --------    d-----w    c:\programmer\RegSupreme
2009-04-19 09:32 . 2009-04-19 09:32    --------    d-----w    c:\programmer\CCleaner
2009-04-18 14:34 . 2009-04-18 14:34    --------    d-----w    c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2009-04-18 13:48 . 2009-04-18 13:48    406    ----a-w    c:\windows\system32\ioloBootDefrag.cfg
2009-04-18 13:48 . 2009-04-18 13:48    --------    d-----w    c:\documents and settings\HP_Ejer\Application Data\iolo
2009-04-18 13:48 . 2009-04-18 13:48    --------    d-----w    c:\documents and settings\All Users\Application Data\iolo
2009-04-15 21:22 . 2009-04-15 21:22    --------    d-----w    c:\programmer\MSSOAP
2009-04-15 18:31 . 2009-04-15 21:22    164    ----a-w    c:\windows\install.dat
2009-04-14 18:58 . 2009-02-06 10:10    227840    -c----w    c:\windows\system32\dllcache\wmiprvse.exe
2009-04-14 18:58 . 2009-03-06 14:20    284672    -c----w    c:\windows\system32\dllcache\pdh.dll
2009-04-14 18:58 . 2009-02-09 11:25    110592    -c----w    c:\windows\system32\dllcache\services.exe
2009-04-14 18:58 . 2009-02-09 10:53    473600    -c----w    c:\windows\system32\dllcache\fastprox.dll
2009-04-14 18:58 . 2009-02-09 10:53    401408    -c----w    c:\windows\system32\dllcache\rpcss.dll
2009-04-14 18:58 . 2009-02-09 10:53    682496    -c----w    c:\windows\system32\dllcache\advapi32.dll
2009-04-14 18:58 . 2009-02-09 10:53    730624    -c----w    c:\windows\system32\dllcache\lsasrv.dll
2009-04-14 18:58 . 2009-02-09 10:53    719360    -c----w    c:\windows\system32\dllcache\ntdll.dll
2009-04-14 18:58 . 2009-02-09 10:53    453120    -c----w    c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-14 18:58 . 2009-03-27 06:53    1203922    -c----w    c:\windows\system32\dllcache\sysmain.sdb
2009-04-14 18:58 . 2008-04-21 21:15    217088    -c----w    c:\windows\system32\dllcache\wordpad.exe
2009-04-01 12:09 . 2009-04-01 12:09    --------    d-----w    c:\documents and settings\LocalService\Lokale indstillinger\Application Data\HP
2009-04-01 08:02 . 2009-04-01 08:02    --------    d-----w    C:\temp
2009-03-25 12:14 . 2009-03-25 12:14    4    --shatr    c:\documents and settings\All Users\Application Data\sysqcl1129139270.dat
2009-03-25 12:12 . 2009-03-25 12:12    11770368    ----a-w    C:\comiclife-win.exe
2009-03-23 14:43 . 2009-04-20 19:22    --------    d-----w    c:\documents and settings\HP_Ejer\Tracing
2009-03-23 14:41 . 2009-03-23 14:41    --------    d-----w    c:\programmer\Microsoft
2009-03-23 14:41 . 2009-03-23 14:41    --------    d-----w    c:\programmer\Windows Live SkyDrive
2009-03-23 14:39 . 2009-03-23 14:39    --------    d-----w    c:\programmer\Fælles filer\Windows Live

.
((((((((((((((((((((((((((((((((((((((((  Find3M Rapport  ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-03 15:45 . 2007-05-14 15:51    --------    d-----w    c:\programmer\Fælles filer\Wise Installation Wizard
2009-04-19 10:37 . 2008-01-29 15:29    33808    ----a-w    c:\windows\system32\drivers\klbg.sys
2009-04-19 09:57 . 2008-01-07 17:13    4212    ---ha-w    c:\windows\system32\zllictbl.dat
2009-04-19 09:56 . 2009-03-18 23:41    --------    d-----w    c:\documents and settings\All Users\Application Data\avg8
2009-04-15 21:25 . 2008-12-18 13:36    --------    d-----w    c:\documents and settings\All Users\Application Data\Webroot
2009-04-15 21:19 . 2008-12-25 16:50    39378704    ----a-w    C:\SpySweeperRegSetup_GBR.exe
2009-04-15 21:13 . 2006-02-28 20:19    --------    d-----w    c:\programmer\Google
2009-04-15 13:25 . 2004-01-01 15:22    64750    ----a-w    c:\windows\system32\perfc006.dat
2009-04-15 13:25 . 2004-01-01 15:22    400142    ----a-w    c:\windows\system32\perfh006.dat
2009-04-06 11:32 . 2008-12-25 16:56    1563008    ----a-w    c:\windows\WRSetup.dll
2009-04-02 12:30 . 2008-12-18 13:36    176752    ----a-w    c:\windows\system32\drivers\ssidrv.sys
2009-04-02 12:30 . 2008-12-18 13:36    23152    ----a-w    c:\windows\system32\drivers\sshrmd.sys
2009-04-02 12:30 . 2008-08-09 13:42    29808    ----a-w    c:\windows\system32\drivers\ssfs0bbc.sys
2009-04-01 07:47 . 2008-12-18 11:53    4931413    ----a-w    c:\windows\Internet Logs\tvDebug.Zip
2009-03-26 17:37 . 2008-07-10 17:12    267152    ----a-w    C:\zaSetup_en.exe
2009-03-23 14:43 . 2005-02-20 12:47    89696    ----a-w    c:\documents and settings\HP_Ejer\Lokale indstillinger\Application Data\GDIPFONTCACHEV1.DAT
2009-03-23 14:41 . 2008-01-27 13:01    --------    d-----w    c:\programmer\Windows Live
2009-03-16 09:13 . 2009-03-16 09:13    268    ---ha-w    C:\sqmdata12.sqm
2009-03-16 09:13 . 2009-03-16 09:13    244    ---ha-w    C:\sqmnoopt12.sqm
2009-03-06 14:20 . 2004-01-01 14:25    284672    ----a-w    c:\windows\system32\pdh.dll
2009-03-06 14:10 . 2007-01-23 17:19    --------    d-----w    c:\programmer\Yahoo!
2009-03-05 14:59 . 2009-03-02 13:00    --------    d-----w    c:\documents and settings\HP_Ejer\Application Data\U3
2009-03-03 00:11 . 2006-06-23 11:27    826368    ----a-w    c:\windows\system32\wininet.dll
2009-02-26 09:51 . 2008-06-22 18:54    --------    d-----w    c:\programmer\Microsoft Silverlight
2009-02-23 21:37 . 2009-02-23 21:37    --------    d-----w    c:\programmer\MSECache
2009-02-20 17:12 . 2007-06-27 13:04    78336    ----a-w    c:\windows\system32\ieencode.dll
2009-02-10 17:08 . 2002-09-09 21:07    2068608    ----a-w    c:\windows\system32\ntkrnlpa.exe
2009-02-09 14:07 . 2004-01-01 15:22    1846784    ----a-w    c:\windows\system32\win32k.sys
2009-02-09 11:26 . 2004-01-01 15:22    2191616    ----a-w    c:\windows\system32\ntoskrnl.exe
2009-02-09 11:25 . 2004-01-01 14:26    110592    ----a-w    c:\windows\system32\services.exe
2009-02-09 10:53 . 2004-01-01 15:22    730624    ----a-w    c:\windows\system32\lsasrv.dll
2009-02-09 10:53 . 2005-07-26 04:38    401408    ----a-w    c:\windows\system32\rpcss.dll
2009-02-09 10:53 . 2004-01-01 15:22    719360    ----a-w    c:\windows\system32\ntdll.dll
2009-02-09 10:53 . 2004-01-01 14:19    682496    ----a-w    c:\windows\system32\advapi32.dll
2009-02-06 17:52 . 2009-02-06 17:52    49504    ----a-w    c:\windows\system32\sirenacm.dll
2009-02-06 10:39 . 2004-01-01 14:26    35328    ----a-w    c:\windows\system32\sc.exe
2009-02-03 19:58 . 2004-01-01 14:26    56832    ----a-w    c:\windows\system32\secur32.dll
2006-04-20 14:54 . 2006-04-20 14:54    70104    ----a-w    c:\documents and settings\Prootools\Lokale indstillinger\Application Data\GDIPFONTCACHEV1.DAT
2005-02-21 16:29 . 2005-02-21 16:29    0    ---ha-w    c:\programmer\Fælles filer\MSN
2005-02-20 12:47 . 2007-04-01 13:07    136    ----a-w    c:\documents and settings\HP_Ejer\Lokale indstillinger\Application Data\fusioncache.dat
2004-01-01 09:43 . 2006-04-20 14:54    133    ----a-w    c:\documents and settings\Prootools\Lokale indstillinger\Application Data\fusioncache.dat
1998-02-10 15:34 . 2006-04-20 16:02    128000    ----a-w    c:\programmer\UNWISE.EXE
2007-06-15 10:09 . 2007-06-15 10:09    53    --sha-w    c:\windows\system32\475037660.dat
2008-10-21 14:21 . 2008-10-21 14:22    32768    --sha-w    c:\windows\system32\config\systemprofile\Lokale indstillinger\Oversigt\History.IE5\MSHist012008102120081022\index.dat
.

(((((((((((((((((((((((((((((((((((  Start steder i reg.basen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Bemærk* tomme linier & lovlige standard linier vises ikke 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\programmer\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-19 68856]
"MsnMsgr"="c:\programmer\Windows Live\Messenger\MsnMsgr.Exe" [2009-02-06 3885408]
"updateMgr"="c:\programmer\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\programmer\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 132496]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"Home Theater SchSvr"="c:\programmer\Fælles filer\InterVideo\SchSvr\SchSvr.exe" [2004-08-20 155648]
"WINREMOTE"="c:\programmer\InterVideo\Common\Bin\WinRemote.exe" [2004-06-25 192512]
"iTunesHelper"="c:\programmer\iTunes\iTunesHelper.exe" [2004-05-11 286720]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2004-04-14 233472]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2004-07-12 4112384]
"nwiz"="c:\windows\system32\nwiz.exe" [2004-07-12 843776]
"SiS Windows KeyHook"="c:\windows\System32\keyhook.exe" [2004-05-20 249856]
"AlcxMonitor"="c:\windows\ALCXMNTR.EXE" [2003-04-04 50176]
"Reminder"="c:\windows\Creator\Remind_XP.exe" [2003-12-17 118784]
"SetDefaultPrinter"="c:\hp\bin\cloaker.exe" [1999-11-07 27136]
"Sony Ericsson PC Suite"="c:\programmer\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 159744]
"KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440]
"QuickTime Task"="c:\programmer\QuickTime\qttask.exe" [2009-01-05 413696]
"AVP"="c:\programmer\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-04-19 206088]
"SpySweeper"="c:\programmer\Webroot\Spy Sweeper\SpySweeperUI.exe" [2009-04-06 6345840]

c:\documents and settings\HP_Ejer\Menuen Start\Programmer\Start\
Yahoo! Widgets.lnk - c:\programmer\Yahoo!\Widgets\YahooWidgets.exe [2008-3-19 4742184]

c:\documents and settings\All Users\Menuen Start\Programmer\Start\
Adobe Gamma Loader.lnk - c:\programmer\F‘lles filer\Adobe\Calibration\Adobe Gamma Loader.exe [2006-3-14 113664]
Adobe Reader Hurtigstart.lnk - c:\programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WRConsumerService]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

R3 SE31bus;Sony Ericsson Device 049 Driver driver (WDM);c:\windows\system32\DRIVERS\SE31bus.sys [2006-05-01 61600]
R3 SE31mdfl;Sony Ericsson Device 049 USB WMC Modem Filter;c:\windows\system32\DRIVERS\SE31mdfl.sys [2006-05-01 9360]
R3 SE31mdm;Sony Ericsson Device 049 USB WMC Modem Driver;c:\windows\system32\DRIVERS\SE31mdm.sys [2006-05-01 97184]
R3 SE31mgmt;Sony Ericsson Device 049 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\SE31mgmt.sys [2006-05-01 88688]
R3 SE31obex;Sony Ericsson Device 049 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\SE31obex.sys [2006-05-01 86560]
R3 V0260VID;Live! Cam Vista IM;c:\windows\system32\DRIVERS\V0260Vid.sys [2006-04-01 162176]
S0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2009-04-19 33808]
S0 ssfs0bbc;ssfs0bbc;c:\windows\system32\DRIVERS\ssfs0bbc.sys [2009-04-02 29808]
S2 WRConsumerService;Webroot Client Service;c:\programmer\Webroot\Spy Sweeper\WRConsumerService.exe [2009-04-15 1181040]
S3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]
S3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2008-04-30 24592]
S3 PhTVTune;ASUS WDM TV Tuner;c:\windows\system32\DRIVERS\PhTVTune.sys [2004-05-27 24608]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12    REG_MULTI_SZ      Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt    REG_MULTI_SZ      hpqcxs08 hpqddsvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f9f3c690-0729-11de-ae0c-0011d827ff81}]
\Shell\AutoRun\command - G:\LaunchU3.exe -a
.
Indhold af mappen 'Planlagte Opgaver'

2009-03-02 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\programmer\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2009-05-04 c:\windows\Tasks\wrSpySweeperFullSweep.job
- c:\programmer\Webroot\Spy Sweeper\SpySweeperUI.exe [2008-12-18 11:32]

2009-05-04 c:\windows\Tasks\wrSpySweeperFullSweep.job
- c:\programmer\Webroot\Spy Sweeper\SpySweeperUI.exe [2008-12-18 11:32]

2009-04-16 c:\windows\Tasks\wrSpySweeper_L1B08CB7E35E74326A2D227E5053F8841.job
- c:\programmer\Webroot\Spy Sweeper\SpySweeperUI.exe [2008-12-18 11:32]

2009-04-16 c:\windows\Tasks\wrSpySweeper_L1B08CB7E35E74326A2D227E5053F8841.job
- c:\programmer\Webroot\Spy Sweeper\SpySweeperUI.exe [2008-12-18 11:32]
.
- - - - TOMME GENVEJE FJERNET - - - -

HKLM-Run-VTTimer - VTTimer.exe
Notify-avgrsstarter - avgrsstx.dll


.
------- Yderligere scanning -------
.
uStart Page = hxxp://www.google.dk/webhp?rls=ig
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&ksporter til Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
LSP: c:\windows\system32\bglsp.dll
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\programmer\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
DPF: {07E8D22D-C723-485C-BE6F-003241549305} - hxxp://extcom.esoft.dk/extern/3d/eplan.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-20 21:23
Windows 5.1.2600 Service Pack 3 NTFS

scanner skjulte processer ... 

scanner skjulte autostarter ...

scanner skjulte filer ... 

scanning gennemført med succes
skjulte filer: 0

**************************************************************************
.
--------------------- DLLs startet under kørende Processer ---------------------

- - - - - - - > 'lsass.exe'(916)
c:\windows\system32\bglsp.dll

- - - - - - - > 'explorer.exe'(2128)
c:\windows\system32\nview.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\nvwddi.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Andre kørende processer ------------------------
.
c:\programmer\Fælles filer\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\nvsvc32.exe
c:\programmer\Webroot\Spy Sweeper\SpySweeper.exe
c:\programmer\iPod\bin\iPodService.exe
c:\windows\system32\rundll32.exe
c:\programmer\Fælles filer\Teleca Shared\CapabilityManager.exe
c:\programmer\HP\Digital Imaging\bin\hpqtra08.exe
c:\programmer\HP\Digital Imaging\bin\hpqste08.exe
c:\windows\system32\wscntfy.exe
c:\programmer\Webroot\Spy Sweeper\SSU.exe
.
**************************************************************************
.
Gennemført tid: 2009-04-20 22:15 - maskinen blev genstartet
ComboFix-quarantined-files.txt  2009-04-20 20:15

Pre-Kørsel: 131.137.323.008 byte ledig
Post-Kørsel: 131.999.539.200 byte ledig

248    --- E O F ---    2009-04-14 21:00